Merge 1d2514c into 317ee96

.github/ISSUE_TEMPLATE/---bug-report.md

@@ -0,0 +1,43 @@
+---
+name: "\U0001F41E Bug report"
+about: Something isn't working as expected? Here is the right place to report.
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!--
+Please fill out each section below, otherwise, your issue will be closed. This info allows django CMS maintainers to diagnose (and fix!) your issue as quickly as possible.
+-->
+
+## Description
+
+<!--
+If this is a security issue stop right here and follow our documentation:
+http://docs.django-cms.org/en/latest/contributing/development-policies.html#reporting-security-issues
+-->
+
+## Steps to reproduce
+
+<!--
+Clear steps describing how to reproduce the issue.
+-->
+
+## Expected behaviour
+
+<!--
+A clear and concise description of what you expected to happen.
+-->
+
+## Actual behaviour
+
+<!--
+A clear and concise description of what is actually happening.
+-->
+
+## Additional information
+
+<!--
+Add any other context about the problem such as environment, CMS/Python/Django versions, logs etc. here.
+-->

.github/ISSUE_TEMPLATE/---feature-requests.md

@@ -0,0 +1,12 @@
+---
+name: "\U0001F4A1 Feature requests"
+about: Please submit and discuss feature requests via google groups.
+title: "[FEATURE]"
+labels: 'status: marked for rejection'
+assignees: ''
+
+---
+
+<!--
+Head over to https://groups.google.com/forum/#!forum/django-cms and submit your ideas.
+-->

.github/ISSUE_TEMPLATE/---question.md

@@ -0,0 +1,18 @@
+---
+name: "\U0001F914 Question"
+about: Please use our community channels to ask for questions.
+title: ''
+labels: 'status: marked for rejection'
+assignees: ''
+
+---
+
+<!--
+Please use one of the following community channels to ask your questions instead of GitHub:
+
+* Stackoverflow: https://stackoverflow.com/questions/tagged/django-cms
+* Mailing list: https://groups.google.com/forum/#!forum/django-cms
+* #django-cms on freenode.net 
+
+Questions submitted through GitHub will be closed. Our community is very helpful and we try to answer as many questions as you may have.
+-->

AUTHORS

@@ -289,6 +289,7 @@ Contributors (based on gitlog, 543 unique authors):
 * Keryn Knight
 * Kevin Burton
 * Kevin Funk
+* Kevin Möllering
 * Kevin Richardson
 * Kim Thoenen
 * kochin
@@ -465,6 +466,7 @@ Contributors (based on gitlog, 543 unique authors):
 * Samuel Lahti
 * Samuel Luescher
 * Samuel Lüscher
+* saqlainsyed007
 * Sascha Marcel Schmidt
 * sbussetti
 * Schoen
@@ -503,6 +505,7 @@ Contributors (based on gitlog, 543 unique authors):
 * Stephan Hepper
 * Stephan Herzog
 * Stephan Jaekel
+* Stephan Michaud
 * Stephen Muss
 * Stephen Paulger
 * Stephen Watkin

CHANGELOG.txt

@@ -1,7 +1,23 @@
-=== 3.8.0 (unreleased) ===
-
-* ...
+=== 3.7.1 (unreleased) ===
 
+* Fixed a bug where creating a page via the ``cms.api.create_page`` ignores
+  left/right positions.
+* Fixed documentation example for ``urls.py`` when using multiple languages.
+* Mark public static placeholder dirty when published.
+* Fixed a bug where ``request.current_page`` would always be the public page,
+  regardless of the toolbar status (draft / live). This only affected custom
+  urls from an apphook.
+* Fixed a bug where the menu would render draft pages even if the page on
+  the request was a public page. This happens when a user without change
+  permissions requests edit mode.
+* Fixed the 'urls.W001' warning with custom apphook urls
+* Prevent non-staff users to login with the django CMS toolbar
+* Added missing ``{% trans %}?? to toolbar shortcuts.
+* Updated branch policy.
+* Improved and simplified permissions documentation.
+* Improved apphooks documentation.
+* Improved CMSPluginBase documentation.
+* Improved documentation related to nested plugins.
 
 === 3.7.0 (2019-09-25) ===
 

README.rst

@@ -21,11 +21,7 @@ Open source enterprise content management system based on the Django framework.
 
 .. ATTENTION::
 
-    To propose **significant new features**, open pull requests based on and made against the **develop** branch. It's
-    the branch for features that will go into the next django CMS feature release.
-
-    To propose **fixes and backwards-compatible improvements**, please work on the latest **release** branch. This is
-    the branch that will become the next PyPI release ("the next version of django CMS").
+    Please use the ``develop`` branch as the target for pull requests for on-going development.
 
     Security fixes will be backported to older branches by the core team as appropriate.
 

cms/appresolver.py

@@ -149,7 +149,7 @@ def recurse_patterns(path, pattern_list, page_id, default_args=None,
 
             regex_pattern = regex
             if not DJANGO_1_11:
-                regex_pattern = RegexPattern(regex, name=pattern.name)
+                regex_pattern = RegexPattern(regex, name=pattern.name, is_endpoint=True)
             resolver = URLPattern(regex_pattern, pattern.callback, args,
                                   pattern.name)
         resolver.page_id = page_id

cms/forms/login.py

@@ -1,8 +1,8 @@
 from django import forms
-from django.contrib.auth.forms import AuthenticationForm
+from django.contrib.admin.forms import AdminAuthenticationForm
 
 
-class CMSToolbarLoginForm(AuthenticationForm):
+class CMSToolbarLoginForm(AdminAuthenticationForm):
 
     def __init__(self, *args, **kwargs):
         super(CMSToolbarLoginForm, self).__init__(*args, **kwargs)

cms/models/pagemodel.py

@@ -96,7 +96,7 @@ def add_sibling(self, pos=None, *args, **kwargs):
             kwargs['instance'].parent_id = self.parent_id
         else:
             kwargs['parent_id'] = self.parent_id
-        return super(TreeNode, self).add_sibling(*args, **kwargs)
+        return super(TreeNode, self).add_sibling(pos, *args, **kwargs)
 
     def update(self, **data):
         cls = self.__class__

cms/models/static_placeholder.py

@@ -70,6 +70,7 @@ def clean(self):
     def publish(self, request, language, force=False):
         if force or self.has_publish_permission(request):
             self.public.clear(language=language)
+            self.public.clear_cache(language=language)
             plugins = self.draft.get_plugins_list(language=language)
             copy_plugins_to(plugins, self.public, no_signals=True)
             self.dirty = False

cms/templates/cms/toolbar/toolbar_javascript.html

@@ -42,7 +42,7 @@
         'unhandledPageChange': '{% filter escapejs %}{% trans "The page was changed in the meantime, reloading..." %}{% endfilter %}',
         'shortcutAreas': [
             {
-                'title': 'CMS-wide Shortcuts',
+                'title': '{% filter escapejs %}{% trans "CMS-wide Shortcuts" %}{% endfilter %}',
                 'shortcuts': {
                     'help': {
                         'shortcut': '?',
@@ -71,7 +71,7 @@
                 }
             },
             {
-                'title': 'Structureboard',
+                'title': '{% filter escapejs %}{% trans "Structureboard" %}{% endfilter %}',
                 'shortcuts': {
                     'placeholders': {
                         'shortcut': 'f > p / alt+p',

cms/templatetags/cms_js_tags.py

@@ -46,7 +46,7 @@ def render_cms_structure_js(context, renderer, obj):
         }
 
         if static_placeholder.site_bound:
-            kwargs['site'] = renderer.current_site.pk
+            kwargs['site'] = renderer.current_site
         else:
             kwargs['site_id__isnull'] = True
 

cms/test_utils/project/templates/placeholder_tests/static_with_site.html

@@ -0,0 +1,5 @@
+{% load cms_tags %}
+
+{% cms_toolbar %}
+
+{% static_placeholder 'test-static' site %}

cms/tests/test_api.py

@@ -242,3 +242,12 @@ def test_create_page_assert_parent_is_draft(self):
     def test_create_page_page_title(self):
         page = create_page(**dict(self._get_default_create_page_arguments(), page_title='page title'))
         self.assertEqual(page.get_title_obj_attribute('page_title'), 'page title')
+
+    def test_create_page_with_position_regression_6345(self):
+        # ref: https://github.com/divio/django-cms/issues/6345
+        parent = create_page('p', 'nav_playground.html', 'en')
+        rightmost = create_page('r', 'nav_playground.html', 'en', parent=parent)
+        leftmost = create_page('l', 'nav_playground.html', 'en', parent=rightmost, position='left')
+        create_page('m', 'nav_playground.html', 'en', parent=leftmost, position='right')
+        children_titles = list(p.get_title('de') for p in parent.get_child_pages())
+        self.assertEqual(children_titles, ['l', 'm', 'r'])

cms/tests/test_apphooks.py

@@ -9,6 +9,7 @@
 from django.contrib.sites.models import Site
 from django.core import checks
 from django.core.cache import cache
+from django.core.checks.urls import check_url_config
 from django.test.utils import override_settings
 from django.urls import NoReverseMatch, clear_url_caches, resolve, reverse
 from django.utils import six
@@ -124,6 +125,15 @@ def create_base_structure(self, apphook, title_langs, namespace=None):
 
         return titles
 
+    @override_settings(ROOT_URLCONF='cms.test_utils.project.fourth_urls_for_apphook_tests')
+    def test_check_url_config(self):
+        """
+        Test for urls config check.
+        """
+        self.apphook_clear()
+        result = check_url_config(None)
+        self.assertEqual(len(result), 0)
+
     @override_settings(CMS_APPHOOKS=['%s.%s' % (APP_MODULE, APP_NAME)])
     def test_explicit_apphooks(self):
         """

cms/tests/test_menu.py

@@ -504,6 +504,28 @@ def test_show_menu_cache_key_leak(self):
         tpl.render(context)
         self.assertEqual(CacheKey.objects.count(), 1)
 
+    def test_menu_nodes_request_page_takes_precedence(self):
+        """
+        Tests a condition where the user requests a draft page
+        but the page object on the request is a public page.
+        This can happen when the user has no permissions to edit
+        the requested draft page.
+        """
+        public_page = self.get_page(1)
+        draft_page = public_page.publisher_public
+        edit_on_path = draft_page.get_absolute_url() + '?%s' % get_cms_setting('CMS_TOOLBAR_URL__EDIT_ON')
+
+        with self.login_user_context(self.get_superuser()):
+            context = self.get_context(path=edit_on_path, page=public_page)
+            context['request'].session['cms_edit'] = True
+            Template("{% load menu_tags %}{% show_menu %}").render(context)
+        # All nodes should be public nodes because the request page is public
+        nodes = [node for node in context['children']]
+        node_ids = [node.id for node in nodes]
+        page_count = Page.objects.public().filter(pk__in=node_ids).count()
+        self.assertEqual(len(node_ids), page_count, msg='Not all pages in the public menu are public')
+        self.assertEqual(nodes[0].selected, True)
+
     def test_menu_cache_draft_only(self):
         # Tests that the cms uses a separate cache for draft & live
         public_page = self.get_page(1)

cms/tests/test_site.py

@@ -110,3 +110,20 @@ def test_site_publish(self):
                         page_url = page.get_absolute_url(language='de')
                     response = self.client.get(page_url)
                     self.assertEqual(response.status_code, 200)
+
+
+class TestSiteBoundStaticPlaceholder(SiteTestCase):
+    def setUp(self):
+        super(TestSiteBoundStaticPlaceholder, self).setUp()
+        with self.settings(
+            CMS_TEMPLATES=(('placeholder_tests/static_with_site.html', 'tpl'), ),
+        ):
+            self.test_page = create_page('page', 'placeholder_tests/static_with_site.html', language='de')
+
+    def tearDown(self):
+        self.test_page.delete()
+        super(TestSiteBoundStaticPlaceholder, self).tearDown()
+
+    def test_create_site_specific_placeholder(self):
+            response = self.client.get(self.test_page.get_absolute_url(language='de') + '?structure')
+            self.assertEqual(response.status_code, 200)

cms/tests/test_toolbar.py

@@ -187,6 +187,15 @@ def test_toolbar_login(self):
         self.assertRedirects(response, '/en/admin/')
         self.assertTrue(settings.SESSION_COOKIE_NAME in response.cookies)
 
+    def test_toolbar_login_non_staff(self):
+        admin = self.get_nonstaff()
+        endpoint = reverse('cms_login') + '?next=/en/admin/'
+        username = getattr(admin, get_user_model().USERNAME_FIELD)
+        password = getattr(admin, get_user_model().USERNAME_FIELD)
+        response = self.client.post(endpoint, data={'username': username, 'password': password})
+        self.assertRedirects(response, '/en/admin/?cms_toolbar_login_error=1', target_status_code=302)
+        self.assertFalse(settings.SESSION_COOKIE_NAME in response.cookies)
+
     def test_toolbar_login_error(self):
         admin = self.get_superuser()
         endpoint = reverse('cms_login') + '?next=/en/admin/'

docs/contributing/development-policies.rst

@@ -73,7 +73,7 @@ therefore subject to change.
 The `django CMS developers email list <https://groups.google.com/group/django-cms-developers>`_ serves as gathering
 point for developers. We submit ideas and proposals prior to the roadmap goals.
 
-django CMS 3.4 will be the first "LTS" ("Long-Term Support") release of the application. *Long-term support* means that
+django CMS 3.4 was the first "LTS" ("Long-Term Support") release of the application. *Long-term support* means that
 this version will continue to receive security and other critical updates for 24 months after its first release.
 
 Any updates it does receive will be backward-compatible and will not alter functional behaviour. This means that users
@@ -94,18 +94,12 @@ Branches
 
 We maintain a number of branches on `our GitHub repository <https://github.com/divio/django-cms>`_.
 
-the latest (highest-numbered) ``release/x.y.z``
-    This is the branch that will become the next release on PyPI.
-
-    **Fixes and backwards-compatible improvements** (i.e. most pull requests) will be made against
-    this branch.
-
 ``develop``
-    This is the branch that will become the next release that increments the ``x`` or ``y`` of the latest
-    ``release/x.y.z``.
+    The default target branch for on-going development.
 
-    This branch is for **new features and backwards-incompatible changes**. By their nature, these will require more
-    substantial team co-ordination.
+the latest (highest-numbered) ``release/x.y.z``
+    This is the branch that will become the next release on PyPI. Commits will be cherrypicked from ``develop``
+    and merged into ``release/x.y.z`` during the next iterative release.
 
 Older ``release/x.y.z`` branches
      These represent the final point of development (the highest ``y`` of older versions). Releases in the full set of